Certificates and identification
What we require
A valid eIDAS QWAC (qualified website authentication certificate), presented in a mutual-TLS handshake, issued by a QTSP on the EU trusted list, and carrying the PSD2 attributes defined in ETSI TS 119 495:
- your roles (PSP_AI, PSP_PI, PSP_IC, PSP_AS)
- your NCA name and identifier
- your authorisation number, in the subject’s
organizationIdentifier(OID 2.5.4.97)
What we do not require
QSealC request signing is not required. Berlin Group makes it an ASPSP option; we do not exercise it. The QWAC already authenticates the channel, and requiring signed payloads as well would add integration work for marginal gain. If that ever changes it will be announced three months in advance, as a breaking change.
How your roles gate the API
Your certificate’s roles decide which services you may reach. We read them from your registry record, which mirrors the verified certificate.
| Role | Services |
|---|---|
| PSP_AI (AISP) | /v1/accounts/**, consents |
| PSP_PI (PISP) | /v1/payments/** |
| PSP_IC (CBPII) | /v1/funds-confirmations |
Calling outside your roles returns ROLE_INVALID (403). A certificate with
no readable PSD2 QcStatement yields no roles — it does not fall back to a
default set.
Registration, and why there is no application
Your first request with a valid certificate creates your registry entry automatically. This is bookkeeping we perform, not permission you request: RTS Art. 32(3) forbids requiring a contract, a fee, or a prior approval step.
We then corroborate your authorisation against the EBA/NCA register, at registration and roughly every 90 days after.
Why the register matters more than the certificate
A QWAC is valid for one to two years. An authorisation can be withdrawn tomorrow. Trusting the certificate alone would leave a window in which a de-authorised firm still holds a cryptographically perfect credential.
So:
- If the register says authorised, you are verified and access continues.
- If it says withdrawn or suspended, your access is suspended automatically. No human decision is involved; we are enforcing your own regulator’s.
- If the register is unreachable, nothing changes. An outage is not evidence in either direction, and we retry the next day.
Certificate rotation
Rotate freely. A new certificate is a new fingerprint, so it is verified on first use. Your registry continuity comes from your authorisation number, not the certificate.
Rotate before expiry. We warn ourselves 30 days out, but the request-time
gate is unforgiving: an expired certificate is CERTIFICATE_EXPIRED (401) from
the moment it lapses.
What “blocked” means
SERVICE_BLOCKED (403) means your registry entry is not currently permitted
to reach the interface. Two very different causes produce it:
- Register-driven — your regulator no longer lists you. Resolve it with them; we will pick up the change on the next verification.
- Art. 68(5) block — we blocked you on evidenced fraud or unauthorised-access grounds. This requires two of our staff, a recorded reason, and immediate notification to FIN-FSA. If this happens, contact support; the reason exists in writing.
A pending verification also blocks: we let you register, but an unverifiable
authorisation claim does not get data.